CVE-2026-110754

A flaw was found in Text::CSV_XS. When parsing a CSV record containing a syntax error, the getline function fails to release memory allocated for fields parsed prior to the failure. An attacker who can supply malformed CSV input to a long-running application can exploit this vulnerability to trigger repeated memory leaks, ultimately leading to memory exhaustion and a Denial of Service (DoS).

This vulnerability is evaluated with a Moderate severity rating because successful exploitation leads strictly to resource exhaustion without compromising system confidentiality or integrity. The risk is primarily confined to persistent network-facing services or daemonized environments where malformed entries are continually handled over time. Standard command-line tools or batch jobs that execute intermittently remain largely unaffected, as memory allocations are reclaimed upon process exit.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.